Ubuntu配置Fail2Ban防止SSH暴力破解与邮件预警

su 
wget https://raw.githubusercontent.com/FunctionClub/Fail2ban/master/fail2ban.sh
bash fail2ban.sh

 * Restarting authentication failure monitor fail2ban                                                                                                                [ OK ]
Finish Installing ! Reboot the sshd now !
ssh stop/waiting
ssh start/running, process 15018

Telegram Group: https://t.me/functionclub
Google Puls: https://plus.google.com/communities/113154644036958487268
Github: https://github.com/FunctionClub
QQ Group:277717865
Fail2ban is now runing on this server now!

cat /etc/fail2ban/jail.local
#defalut这里是设定全局设置，如果下面的监控没有设置就以全局设置的值设置。
[DEFAULT]
ignoreip = 127.0.0.1 //用于指定哪些地址ip可以忽略 fail2ban 防御,以空格间隔
bantime = 86400 //客户端主机被禁止的时长（默认单位为秒）
maxretry = 5 //匹配到的密码输入次数阈值
findtime = 1800 //过滤的时长（秒）
destemail = user@seu.edu.cn //接收报警的邮件地址
sender = user@seu.edu.cn //发送者邮件地址
mta = mail //邮件发送软件
protocol = tcp

[ssh-iptables]
enabled = true //是否开启
filter = sshd //过滤规则
action = iptables[name=SSH, port=ssh, protocol=tcp] //动作
logpath = /var/log/auth.log //日志文件路径
maxretry = 5 //匹配到的密码输入次数阈值
findtime = 3600 //过滤的时长（秒）
bantime = 86400 //客户端主机被禁止的时长（默认单位为秒）

su
wget https://raw.githubusercontent.com/FunctionClub/Fail2ban/master/uninstall.sh
bash uninstall.sh

start	                	      启动fail2ban server和监狱
reload	                	    重新加载配置文件
stop	                	      暂停fail2ban和监狱
status	                	    查看运行的监控服务数量和列表
set loglevel	                设置日志等级，有 CRITICAL, ERROR, WARNING,NOTICE, INFO, DEBUG
get loglevel	                获取当前日志的等级
set <JAIL> idle on|off 	      设置某个监控（监狱）的状态。
set <JAIL> addignoreip <IP>   设置某个监控（监狱）可以忽略的ip
set <JAIL> delignoreip <IP>	  删除某个监控（监狱）可以忽略的ip
set <JAIL> banip <IP>	        将ip加入 监控（监狱）
set <JAIL> unbanip <IP>	      将ip从监控（监狱）移除

fail2ban-client set ssh unbanip XXX.XXX.XXX.XXX

sudo vi /etc/nail.rc

## Add sendmail settings
set from=USER@seu.edu.cn //发信人邮箱
set smtp=smtps://smtp.seu.edu.cn:465 //发信人邮箱的SMTP地址
set smtp-auth-user=USER@seu.edu.cn //发信人邮箱登陆账号
set smtp-auth-password=PASSWORD //发信人邮箱的密码
set smtp-auth=login     //认证方式
set ssl-verify=ignore //忽略证书警告
set nss-config-dir=/etc/pki/nssdb //证书所在目录

cat /etc/fail2ban/jail.local
#defalut这里是设定全局设置，如果下面的监控没有设置就以全局设置的值设置。
[DEFAULT]
ignoreip = 127.0.0.1 //用于指定哪些地址ip可以忽略 fail2ban 防御,以空格间隔
bantime = 86400 //客户端主机被禁止的时长（默认单位为秒）
maxretry = 5 //匹配到的密码输入次数阈值
findtime = 1800 //过滤的时长（秒）
destemail = u1@seu.edu.cn //接收报警的邮件地址
sender = u2@seu.edu.cn //发送者邮件地址
mta = mail //邮件发送软件
protocol = tcp

[ssh-iptables]
enabled = true //是否开启
filter = sshd //过滤规则
action = iptables[name=SSH, port=ssh, protocol=tcp] //动作
## action = mail[name=SSH, dest=u1@seu.edu.cn]
mail-whois[name=SSH, dest=u1@seu.edu.cn, sender=u2@seu.edu.cn] //邮件发送
logpath = /var/log/auth.log //日志文件路径
maxretry = 5 //匹配到的密码输入次数阈值
findtime = 3600 //过滤的时长（秒）
bantime = 86400 //客户端主机被禁止的时长（默认单位为秒）

vi /etc/fail2ban/action.d/mail-whois.conf
# Fail2Ban configuration file
#
# Author: Cyril Jaquier
#
#

[Definition]

# Option:  actionstart
# Notes.:  command executed once at the start of Fail2Ban.
# Values:  CMD
#
actionstart = printf %%b "Hi,\n
              The jail <name> has been started successfully.\n
              Regards,\n
              Fail2Ban"|mail -s "[Fail2Ban] <name>: started on `uname -n`" <dest>

# Option:  actionstop
# Notes.:  command executed once at the end of Fail2Ban
# Values:  CMD
#
actionstop = printf %%b "Hi,\n
             The jail <name> has been stopped.\n
             Regards,\n
             Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped on `uname -n`" <dest>

# Option:  actioncheck
# Notes.:  command executed once before each actionban command
# Values:  CMD
#
actioncheck =

# Option:  actionban
# Notes.:  command executed when banning an IP. Take care that the
#          command is executed with Fail2Ban user rights.
# Tags:    See jail.conf(5) man page
# Values:  CMD
#
actionban = printf %%b "Hi,\n
            The IP <ip> has just been banned by Fail2Ban after
            <failures> attempts against <name>.\n\n
            Here are more information about <ip>:\n
            `whois <ip>`\n
            `/bin/curl http://ip.taobao.com/service/getIpInfo.php?ip=<ip>`\n\n
            Regards,\n
            Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip> from `uname -n`" <dest>

# Option:  actionunban
# Notes.:  command executed when unbanning an IP. Take care that the
#          command is executed with Fail2Ban user rights.
# Tags:    See jail.conf(5) man page
# Values:  CMD
#
actionunban =

[Init]

# Default name of the chain
#
name = default

# Destination/Addressee of the mail
#
dest = root

sudo fail2ban-client reload